How Y NOT works

Most people never speculate because they can’t stomach losing their savings. Y NOT removes that fear by changing what is at stake. You deposit USDC and it is automatically supplied to Kamino, one of the largest and most trusted lending protocols on Solana, where it earns a safe, variable yield, usually 5 to 7% a year. Your money sits in a proven, secure place the whole time. Instead of quietly collecting that yield, you stake it on one simple question, and your deposit is never touched.

The question is always the same shape: will an asset be Above or Below a set price at a set date. Pick a side, and your yield joins everyone else’s in a single pot. When the market settles, the correct side splits the pot. The other side simply gets its deposit back. Worst case for anyone is a 0% month. Your deposit is never on the table.

Every market is defined by three things, and nothing else:

Two sides sit against that strike. Above says the price finishes over the line, Below says under. You deposit onto one side. That is the whole interface: a price, a date, and a direction.

There is no market maker and no counterparty setting a spread. Y NOT is parimutuel: the crowd itself sets the odds, exactly like a shared betting pool. Everyone’s yield goes into one pot, and the winning side divides that pot between its members.

Your share is weighted by how much you put in and how early you were. Concretely, each deposit earns weight equal to its amount multiplied by the seconds it stays locked until maturity:

Because the pot is split by weight, the fewer people on your side, the bigger your slice. Back the crowded side and you are right but you split thin. Back the lonely side and you are contrarian: if it lands, a small minority divides the entire pot. A strongly contrarian correct call can pay a yield many times the plain lending rate. The odds you see are live, because they are just the current split of the pool.

A protocol fee of 20% is taken from the pot before it is split. That is the only cut anyone takes: player versus player, one pot, no spread in the middle.

This is the core guarantee. Only yield ever enters the pot. Your deposited USDC is held for you and returned in full at maturity, whichever side you chose and however the market settles. Losing simply means a 0% month on that deposit. There is no scenario in the design where a settlement takes your money, because your money was never what you wagered.

That is what makes Y NOT speculation for people who would never gamble. The upside is real, the downside is bounded at zero, and the thing you cannot afford to lose is structurally out of reach.

At maturity the market is settled against the asset’s price. For crypto markets that price is read directly from a live Pyth oracle at settle time and compared to the strike: at or above sends the pot to Above, under sends it to Below.

Tokenized equity markets settle from a keeper attested price rather than an on chain equity oracle, so the same one question, one strike, one pot engine extends to any asset with a reliable price, not only those with a native feed. Once settled, the winning side’s members claim their deposit plus their weighted slice of the pot. The losing side claims its deposit back.

The whole protocol is an Anchor program on Solana. State lives in program derived accounts, so a market and every position under it are deterministic addresses anyone can verify, and the pooled USDC sits in a vault the program alone controls. Fast finality and near zero fees are what make hundreds of small deposits and a one month cadence practical.

Because settlement only needs a price and a pool, Y NOT works on any asset that has an oracle. One shared lending pool sits underneath, and every market on top is just another feed pointed at the same engine, so the protocol scales to hundreds or thousands of markets from one small program, with no new code per asset and no fresh liquidity to bootstrap each time. Crypto, tokenized stocks, indices, commodities, anything with a reliable price. Add a feed, and you have a market.

1. 01
   Create

   Anyone opens a market by naming an asset, a strike, and a maturity. It is born with a little seed liquidity on each side so the odds are real from the first deposit.
2. 02
   Deposit

   Players pick Above or Below and deposit USDC. Their yield joins the pot and their weight is booked. Deposits stay open until maturity.
3. 03
   Settle

   At maturity the strike is compared to the live price. One side wins the pot, net of the 20% fee.
4. 04
   Claim

   Everyone withdraws their original deposit. The winning side also collects its weighted share of the pot.

The protocol is a single Anchor program. It rebuilds nothing risky: pooled principal earns yield through a hardened Kamino kLend lending adapter, and settlement reads price through a hardened Pyth PriceUpdateV2 parser that is owner pinned, feed id bound and confidence guarded. Every fund movement is a CPI whose signer is the seed verified market_authority PDA, never an address read from the caller, and every lending call is balance delta verified against a confused deputy guard.

The full instruction set is small enough to hold in your head:

Settlement is pure arithmetic over integers, no floats. At maturity the keeper runs:

total     = withdraw_all_from_kamino()          // principal + accrued yield
gross_pot = total − Σ principal                 // the yield is the prize
outcome   = spot >= strike ? ABOVE : BELOW      // spot read AS OF maturity
fee       = two_sided ? 0.20 × gross_pot : 0    // 20% only when contested
net_pot   = gross_pot − fee

The price is not the price when the keeper happens to call. It is pinned to a window around the maturity timestamp (±30 minutes), and the feed exponent at settle must equal the exponent the strike was set with, or the whole settle reverts rather than silently rescaling and flipping the result.

Redeem then splits the net pot by time weight, so a last-second deposit earns almost nothing:

weight     = amount × seconds_to_maturity       // u128, units of USDC·seconds
your_share = net_pot × weight / winning_weight  // integer div, rounds DOWN
payout     = principal + (won ? your_share : 0) // principal is unconditional

Two edges keep it fair. The 20% fee only applies once the minority side has reached 5% of the pool, a latch that never clears, so a one-sided market pays no fee and a dust deposit beside a whale can neither switch the fee on nor grief it. And if the winning side turns out empty, the pot is refunded across all weight instead of being locked, so nobody is stranded. Rounding always favours custody: shares sum to at most the pot, and any dust stays put.

The one invariant the program is built around: on every solvent path, a redeem pays at least the position’s principal. Four resolution modes all preserve it:

The rest is defensive bookkeeping, most of it learned the hard way in review:

• Conservation: redemptions never exceed custody. Integer division rounds down and every redeem re-checks the real custody balance before paying.
• No double redeem (a redeemed flag), no deposit after maturity, and a side that is fixed the moment you pick it until a full exit closes the position.
• Confused-deputy guard: the protected owner on every lending CPI is the seed-verified market_authority PDA, and every market-owned sibling account is snapshotted and asserted unchanged.
• Exponent pin at settle: a feed whose exponent changed between open and settle reverts instead of resolving against a mismatched scale.

The market state is a flat account. Offsets, for anyone decoding it straight off the wire:

off  size  field
  0     8   discriminator
  8    32   authority            (creator / keeper)
 40    32   usdc_mint
 72    32   pyth_feed            (feed id · also a market seed)
104     8   strike               u64
112     4   strike_expo          i32
116     8   maturity             i64  (unix seconds · a market seed)
124     8   above_principal      u64
132     8   below_principal      u64
140    16   above_weight         u128 (Σ amount × secs)
156    16   below_weight         u128
172     1   settled              bool
173     1   outcome_above        bool
174     8   yield_pot            u64  (net pot after fee)
...          both_sides_funded, recovery_bps, pot_refund_all, oracle_kind, bump

PDAs · market ["market", feed, strike, maturity] · position ["pos", market, owner] · vault ["market_usdc", market] · authority ["market_auth", market]